Training data generation device, method, and program

Abstract

In one aspect of the present invention, a learning data generation device acquires system management information that defines the functions of a target system, and generates a mirror environment corresponding to the actual environment of the target system on the basis of the acquired system management information. For the generated mirror environment, a first operating state simulating a normal operating state in the actual environment of the target system and a second operating state equivalent to an abnormal operating state in the actual environment of the target system are selectively set, operation data respectively generated from the mirror environment in the set first operating state and the second operating state is collected, and the collected operation data is outputted as learning data to the learning model.

Description

[Technical field]

[0001] One aspect of the present invention relates to a learning data generation device, method, and program for generating learning data for a machine learning model that detects anomalies such as failures. [Background technology]

[0002] For example, in operation systems that manage the operating status of networks and facilities, methods using machine learning are being adopted to detect the occurrence of abnormalities such as failures. By using machine learning, it is possible to detect a wide variety of abnormalities in a short period of time without overlooking them, which makes it possible to take countermeasures quickly.

[0003] However, in order to perform highly reliable operation using machine learning, it is necessary to provide a large amount of learning data related to anomalies to the learning model to make the model learn. In order to meet this need, a method has been proposed in the past to artificially generate failures using, for example, chaos engineering technology, thereby generating a large amount of learning data related to anomalies (for example, see Non-Patent Document 1 or Non-Patent Document 2). [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] H. Ikeuchi, J. Ge, Y. Matsuo, and K. Watanabe, “A framework for automatic failure recovery in ICT systems by deep reinforcement learning,” in 2020 IEEE 40th International Conference on Distributed Computing Systems (ICDCS). IEEE, 2020, to be published. [Non-Patent Document 2] J. Kawasaki, G. Mouri, and Y. Suzuki, “Comparative analysis of network fault classification using machine learning,” in NOMS 2020-2020 IEEE / IFIP Network Operations and Management Symposium. IEEE, 2020, pp. 1-6 Summary of the Invention [Problem to be solved by the invention]

[0005] However, the data generation methods proposed so far have been to artificially generate faults in an operational system in an environment where business is actually being carried out, that is, in a real environment (production environment). For this reason, the risk of artificially generated faults or other abnormalities adversely affecting the real environment is unavoidable. In order to build a useful learning model, as mentioned above, it is necessary to provide the learning model with a large amount of learning data related to abnormalities such as faults. However, in consideration of the above-mentioned risk, it is difficult to obtain a sufficient amount of learning data related to abnormalities with conventional methods, and a long learning period is required to build a useful learning model.

[0006] This invention has been made in light of the above-mentioned circumstances, and aims to provide a technology that makes it possible to generate a large amount of learning data related to anomalies in a short period of time without adversely affecting the real environment. [Means for solving the problem]

[0007] To solve the above problems 、In one aspect of the learning data generation device or method according to the present invention, when providing learning data to a learning model of a system that operates an operating state of a target system operating in a real environment using a learning model, system management information defining a function of the target system is acquired, and a mirror environment corresponding to the real environment of the target system is generated based on the acquired system management information. Then, for the generated mirror environment, a first operating state simulating a normal operating state of the target system in the real environment and a second operating state corresponding to an abnormal operating state of the target system in the real environment are selectively set, and operation data generated from the mirror environment in the set first operating state and second operating state are collected, and the collected operation data is output to the learning model as learning data. Furthermore, one embodiment of the present invention includes a recovery processing unit or process that controls the recovery and resetting of the second operating state, and this data management processing unit or process obtains information representing the amount of data required for learning from the learning model, and each time the second operating state is recovered, determines whether the operating data generated in the mirror environment in the second operating state before recovery has reached the amount of data required for learning, and if not, instructs the recovery processing process to reset the second operating state. Effect of the Invention

[0008] According to one aspect of the present invention, a mirror environment corresponding to the actual environment of a target system is reproduced, normal operating states and abnormal operating states are artificially set in the reproduced mirror environment, and operating data generated in these operating states is provided to a learning model as learning data.

[0009] Therefore, it becomes possible to generate a large amount of learning data in a short period of time without adversely affecting the actual environment of the target system, and provide it to the learning model. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a schematic configuration diagram of a system to which a training data generating device according to an embodiment of the present invention is applied. [Diagram 2] FIG. 2 is a block diagram showing the hardware characteristics of the training data generating device according to an embodiment of the present invention. [Diagram 3] FIG. 3 is a block diagram showing a software characteristic of the training data generating device according to an embodiment of the present invention. [Figure 4] FIG. 4 is a diagram showing the flow of data between the training data generation device and the target system 1 and the training model shown in FIG. 3, and the flow of data within the training data generation device. [Diagram 5] FIG. 5 is a flowchart showing the processing procedure and processing contents of the training data generating device shown in FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0012] [One embodiment] (Configuration example) (1) System FIG. 1 is a schematic configuration diagram of a system to which a training data generating device according to an embodiment of the present invention is applied.

[0013] The system according to one embodiment operates the operating state of a target system 1, such as a network system, by a device using a learning model 2, and further includes a learning data generation device 3. The learning data generation device provides learning data to the learning model 2.

[0014] The target system 1 is not limited to a network system, and may be, for example, a server device, a communication device, an office device, a medical device, an in-vehicle device, various housing equipment devices, or home appliances, etc. The learning model 2 and the learning data generation device may be included in the target system 1 or may be connected to each other via a communication line, and the learning data generation device may be included in the learning model 2 or may be connected to each other via a communication line.

[0015] (2) Training data generating device 3 2 and 3 are block diagrams showing the hardware and software configurations, respectively, of the training data generating device 3. As shown in FIG.

[0016] The learning data generating device 3 is, for example, a personal computer, and includes a control unit 10 using a hardware processor such as a central processing unit (CPU). A storage unit having a program storage unit 20 and a data storage unit 30, and an input / output I / F 40 are connected to the control unit 10 via a bus 50.

[0017] The input / output I / F 40 transfers data between the target system 1 and the learning model 2. When the learning data generation device 3 is connected to the target system 1 and the learning model 2 via a communication line, the input / output I / F 40 transmits and receives data according to a communication protocol defined in the communication line.

[0018] The program storage unit 20 is configured, for example, by combining a non-volatile memory such as an HDD (Hard Disk Drive) or SSD (Solid State Drive) as a storage medium that can be written to and read at any time, and a non-volatile memory such as a ROM (Read Only Memory), and stores, in addition to middleware such as an OS (Operating System), programs necessary for executing various control processes related to one embodiment of the present invention.

[0019] The data storage unit 30 is, for example, a combination of a non-volatile memory such as an HDD or SSD, which can be written to and read from at any time, as a storage medium, and a volatile memory such as a RAM (Random Access Memory), and is provided with an initial value data storage unit 31, a fault pattern storage unit 32, and a learning data storage unit 33 as storage areas necessary for implementing one embodiment of the present invention.

[0020] The initial value data storage unit 31 stores, as initial value data, the type and amount of learning data required for learning by the learning model 2. This initial value data is used as an index when executing the learning data generation process.

[0021] The failure pattern storage unit 32 stores failure patterns used when causing failures in a mirror environment reproduced by the real environment reproduction processing unit 11 described later. The failure patterns are set in advance by a system administrator or the like in accordance with all failures that may occur in the real environment of the target system 1, for example. Note that the failure patterns may be set for representative failures among failures that may occur in the real environment.

[0022] The learning data storage unit 33 is used to store, as learning data, operation data generated during normal operation and when a fault occurs in the mirror environment.

[0023] The control unit 10 includes, as processing functions according to an embodiment of the present invention, a real environment reproduction processing unit 11, an event occurrence processing unit 12, a recovery processing unit 13, and a data management processing unit 14. All of these processing units 11 to 14 are realized by causing a hardware processor of the control unit 10 to execute a program stored in the program storage unit 20.

[0024] The real environment reproduction processing unit 11 acquires system management information indicating functions in the real environment from the target system 1, and performs processing to generate a mirror environment corresponding to the real environment of the target system 1 based on the acquired system management information.

[0025] The event generation processing unit 12 performs processing to artificially generate a first operating state simulating a normal operating state and a second operating state corresponding to the operation when a fault occurs in the mirror environment generated by the real environment reproduction processing unit 11.

[0026] The recovery processing unit 13 performs a process of recovering the second operating state generated in the mirror environment, and a process of causing the event generation processing unit 12 to generate the second operating state again in the mirror environment.

[0027] The data management processing unit 14 has the following processing functions. (1) A process of acquiring information indicating the type and amount of data required by the learning model 2 for learning from the learning model 2, and storing the acquired information in the initial value data memory unit 31 as initial value data indicating an indicator for generating learning data.

[0028] (2) A process of selecting an operation mode according to the type of necessary data set as the initial value data. The operation modes include, for example, a first mode in which only a first operation state simulating a normal operation is generated, a second mode in which only a second operation state is generated when a fault occurs, and a third mode in which the first and second operation states are generated in sequence.

[0029] (3) A process of collecting operation data generated in the mirror environment during normal operation and when a fault occurs, with the first and second operating states occurring in the mirror environment, and storing the collected operation data in the learning data storage unit 33.

[0030] (4) Each time the recovery processing unit 13 recovers the second operating state in the mirror environment, it is determined whether or not the operating data collected from the mirror environment in the second operating state before recovery, i.e., the state when the failure occurred, has reached the required data amount set as the initial value data, and the event generation processing unit 12 repeatedly generates the second operating state until the collected data amount reaches the required data amount.

[0031] (5) After the required amount of data has been collected, the collected and stored learning data is read from the learning data storage unit 33 and the learning data is output to the learning model 2.

[0032] (Example of operation) Next, an example of the operation of the training data generating device 3 configured as above will be described. Figure 4 is a diagram showing the flow of data between the target system 1, the learning model 2, and the learning data generating device 3, and the flow of data within the learning data generating device 3, and Figure 5 is a flowchart showing the processing procedure and processing contents by the control unit 10 of the learning data generating device 3.

[0033] (1) Setting the initial value data Under the control of the data management processing unit 14, the control unit 10 of the learning data generation device 3 first acquires, in step S10, information indicating the type and amount of learning data required for learning by the learning model 2 from the learning model 2. Then, the acquired information is stored in the initial value data storage unit 31 as an initial value data ID for the subsequent learning data generation process.

[0034] The type of data may be, for example, normal data or fault data, or both, and the amount of data may be, for example, the time or number of times data is collected.

[0035] (2) Creating a mirror environment Next, in step S11, the control unit 10 of the learning data generation device 3, under the control of the real environment reproduction processing unit 11, acquires system management information SD indicating the functions (e.g., architecture) of the target system 1 from the target system 1, and generates a mirror environment corresponding to the environment (real environment) when the target system 1 actually operates based on the acquired system management information SD. In other words, the real environment of the target system 1 is reproduced as a mirror environment in the learning data generation device 3.

[0036] For example, if the architecture of the target system 1 is hierarchical, as illustrated in FIG. 4, into a physical network layer 1a, a virtual network layer 1b, and a service layer 1c, the real environment reproduction processing unit 11 generates a mirror environment having the hierarchical structure of the real environment.

[0037] (3) Setting an operating condition that simulates a normal operating condition Next, in step S12, the control unit 10 of the learning data generation device 3, under the control of the event occurrence processing unit 12, issues a setting instruction UD for a normal operating state to the real environment reproduction processing unit 11, thereby generating a first operating state that simulates a normal operating state in the real environment of the target system 1 in the mirror environment. The first operating state that simulates the normal operating state includes, for example, a legitimate access operation of a user who uses the network system.

[0038] (4) Operation mode selection When the first operating state simulating the normal operating state of the real environment is set in the mirror environment, the control unit 10 of the learning data generation device 3, under the control of the data management processing unit 14, first determines the operating mode for collecting learning data in step S13.

[0039] The operating modes provided herein include a first operating mode which generates only a first operating state simulating a normal operating state, a second operating mode which generates only a second operating state corresponding to a state in which a fault has occurred, and a third operating mode which sequentially generates a normal operating state and a state in which a fault has occurred.

[0040] The data management processing unit 14 reads information indicating the type of data required by the learning model 2 from the initial value data storage unit 31, and selects a corresponding operation mode from the first, second, and third operation modes according to the type of data read. For example, if the learning model 2 requires data during normal operation, the first operation mode is selected, and if the learning model 2 requires data during a fault occurs, the second operation mode is selected. Furthermore, if the learning model 2 requires both data during normal operation and data during a fault occurs, the third operation mode is selected.

[0041] (5) Collecting learning data (5-1) First operation mode When the first operating mode is selected, the control unit 10 of the learning data generating device 3, under the control of the data management processing unit 14, in step S31, collects data generated in the mirror environment during the above-mentioned normal operation, and stores the collected data during the above-mentioned normal operation in the learning data memory unit 33.

[0042] In step S32, the data management processing unit 14 judges whether the collected and stored data during normal operation reaches the amount of data during normal operation required by the learning model 2 stored in the initial value data storage unit 31. If the result of this judgment is that the collected data does not reach the required data amount, the data collection process during normal operation continues in step S31. Then, when the collected data reaches the required data amount, the data collection process during normal operation ends and proceeds to step S14.

[0043] (5-2) Second operation mode On the other hand, when the second operation mode is selected, the control unit 10 of the learning data generation device 3 reads out a failure pattern from the failure pattern storage unit 32 under the control of the data management processing unit 14 in step S41. Then, the read out failure pattern DP is provided to the event occurrence processing unit 12. In step S42, the event occurrence processing unit 12 provides a failure occurrence instruction DD to the real environment reproduction processing unit 11 in accordance with the failure pattern DP, thereby artificially causing a failure in the mirror environment. In this state, the data management processing unit 14 collects data at the time of the occurrence of a failure in the mirror environment and stores the collected data in the learning data storage unit 33 in step S43.

[0044] Furthermore, when a certain time has elapsed since the occurrence of the failure in the mirror environment, the data management processing unit 14 issues a recovery instruction RR to the recovery processing unit 13. In step S44, the recovery processing unit 13 outputs a failure recovery instruction RS to the real environment reproduction processing unit 11, and temporarily recovers the second operating state in the mirror environment, i.e., the state in which the failure has occurred. Note that the recovery process of the second operating state may be performed autonomously by the recovery processing unit 13 managing the operating state of the mirror environment in the real environment reproduction processing unit 11.

[0045] When the failure state is restored, the data management processing unit 14 judges in step S45 whether the data collected in the failure state reaches the amount of data stored in the initial value data storage unit 31 when the failure occurs, which is required by the learning model 2. If the result of this judgment is that the collected data does not reach the required amount of data, the data management processing unit 14 returns to step S41. Then, a failure pattern DP is provided to the event occurrence processing unit 12. As a result, a failure occurrence instruction DD is provided from the event occurrence processing unit 12 to the real environment reproduction processing unit 11, and as a result, the second operating state in which a failure occurs in the mirror environment is set again.

[0046] The control unit 10 of the learning data generation device 3 thereafter similarly repeatedly executes the data collection process at the time of failure occurrence in the above steps S41 to S45 until the amount of collected data reaches the required amount of data. Then, when the amount of collected data at the time of failure occurrence reaches the required amount of data, the data management processing unit 14 ends the data collection process at that point in time and proceeds to step S14.

[0047] (5-3) Third operation mode When the third operation mode is selected, the control unit 10 of the learning data generation device 3 executes the learning data collection process as follows.

[0048] That is, under the control of the data management processing unit 14, first in step S20, data generated in the mirror environment in the normal operating state is collected, and the collected data is stored in the learning data storage unit 33.

[0049] In step S21, the data management processing unit 14 judges whether the collected and stored data during normal operation has reached the amount of data during normal operation required by the learning model 2, which is stored in the initial value data storage unit 31. If the result of this judgment is that the collected data has not reached the required data amount, the data collection process during normal operation continues in step S20. Then, when the collected data reaches the required data amount, the data collection process during normal operation ends.

[0050] When the data collection process during normal operation is completed, the data management processing unit 14 proceeds to step S22. Then, a fault pattern is read from the fault pattern storage unit 32, and the read fault pattern DP is provided to the event occurrence processing unit 12. In step S23, the event occurrence processing unit 12 provides a fault occurrence instruction DD to the real environment reproduction processing unit 11 according to the fault pattern DP, thereby artificially causing a fault in the mirror environment. In this state, in step S24, the data management processing unit 14 collects data when a fault occurs in the mirror environment, and stores the collected data in the learning data storage unit 33.

[0051] Furthermore, when a certain time has elapsed since the occurrence of the above-mentioned fault in the mirror environment, the data management processing unit 14 issues a recovery instruction RR to the recovery processing unit 13. The recovery processing unit 13 outputs a fault recovery instruction RS to the actual environment reproduction processing unit 11 in step S25, and temporarily recovers the state in which the fault has occurred in the mirror environment, that is, the second operating state. Note that in this case as well, the recovery process of the above-mentioned second operating state may be autonomously performed by the recovery processing unit 13.

[0052] When the failure state is restored, the data management processing unit 14 judges in step S26 whether the data collected and stored in the failure state reaches the amount of data required by the learning model 2 at the time of failure, stored in the initial value data storage unit 31. If the result of this judgment is that the collected data does not reach the required amount of data, the data management processing unit 14 returns to step S22. Then, a failure pattern DP is provided to the event occurrence processing unit 12. This causes the event occurrence processing unit 12 to output a failure occurrence instruction DD to the real environment reproduction processing unit 11, and as a result, the second operating state that causes a failure in the mirror environment is set again.

[0053] The control unit 10 of the learning data generation device 3 thereafter similarly repeatedly executes the data collection process at the time of fault occurrence in the above steps S22 to S26 until the amount of collected data reaches the required amount of data. Then, when the amount of collected data at the time of fault occurrence reaches the required amount of data by repeating the above data collection process, the data management processing unit 14 ends the data collection process at the time of fault occurrence at that point in time, and proceeds to step S14.

[0054] (6) Output of learning data When the data collection process in the first, second or third operation mode is completed, the control unit 10 of the learning data generation processing device 3, under the control of the data management processing unit 14, reads out the learning data stored in the learning data storage unit 33 in step S14. Then, the control unit 10 outputs the read learning data LD from the input / output I / F 40 to the learning model 2.

[0055] 4, the learning model 2 includes a learning processing unit 2a and a learning result storage unit 2b. Upon receiving learning data LD from the learning data generating device 3, the learning processing unit 2a performs a learning process based on the learning data LD and updates and stores the learning result in the learning result storage unit 2b. After the learning process is completed, the learning model 2 transfers the learned data AD stored in the learning result storage unit 2b to the target system 1.

[0056] (Action and effect) As described above, in one embodiment, the actual environment of the target system 1 is reproduced as a mirror environment in the learning data generation device 3. Then, normal operating states and operating states when a fault occurs are artificially generated in this mirror environment, and operation data generated in the mirror environment in these operating states is collected and stored, and the stored data is provided to the learning model 2 as learning data.

[0057] Therefore, it is possible to collect a large amount of learning data in a short period of time both during normal operation and when a fault occurs, and provide the data to the learning model without adversely affecting the actual environment of the target system 1.

[0058] In addition, the second operating state in which a failure occurs is restored at regular intervals, and the data collected at each restoration is compared with the required data amount, and data collection processing at the time of failure occurrence is repeated until the collected data amount reaches the required data amount. This makes it possible to reliably collect learning data at the time of failure occurrence that is required by the learning model 2.

[0059] Furthermore, as operation modes, a first operation mode that generates only a first operation state simulating a normal operation state, a second operation mode that generates only a second operation state corresponding to a state in which a fault has occurred, and a third operation mode that sequentially generates a normal operation state and a state in which a fault has occurred are provided, and the above three operation modes are selected according to the type of learning data required by the learning model 2 to execute the data collection process. This makes it possible to efficiently collect the type of learning data required by the learning model 2.

[0060] [Other embodiments] In the above embodiment, in the data collection process when a failure occurs in the second operating state, failures corresponding to all failure patterns are generated in the mirror environment at once, but this is not limited to this. For example, the data management processing unit 14 may read different failure patterns from the failure pattern storage unit 32 in sequence and generate failures one by one in the mirror environment every time the second operating state is restored. In this way, when there are multiple failure patterns, learning data can be collected for each of them, and it is possible to obtain data at the time of failure occurrence for each of the multiple failure patterns without omission. In addition, at this time, corresponding failures may be selectively generated for all combinations of the multiple failure patterns.

[0061] In addition, the functional configuration, processing procedure and processing content of the training data generating device can be modified in various ways without departing from the spirit and scope of the present invention.

[0062] Although the embodiment of the present invention has been described in detail above, the above description is merely an example of the present invention in every respect. It goes without saying that various improvements and modifications can be made without departing from the scope of the present invention. In other words, in implementing the present invention, a specific configuration according to the embodiment may be appropriately adopted.

[0063] In short, this invention is not limited to the above-mentioned embodiment as it is, and in the implementation stage, the components can be modified and embodied without departing from the gist of the invention. In addition, various inventions can be formed by appropriately combining multiple components disclosed in the above-mentioned embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, components from different embodiments may be appropriately combined. [Explanation of symbols]

[0064] 1. Target system 2. Learning model 3...Learning data generation device 10...Control section 11...Real-world environment reproduction processing section 12...Event occurrence processing section 13...Recovery processing section 14...Data management processing section 20...Program memory section 30...Data storage unit 31...Initial value data storage section 32…Fault pattern memory section 33...Learning data storage unit 40…Communication I / F 50…Bus AD: Learned data LD: learning data SD: System management information ID…Initial value data UD: Normal operation state setting instruction DP: Disorder pattern DD...Failure indication RR...Recovery instruction RS…Fault recovery instructions

Claims

1. A learning data generation device that provides learning data to a learning model of a system that operates an operating state of a target system operating in a real environment using the learning model, comprising: an environment reproduction processing unit that acquires system management information that defines functions of the target system, and generates a mirror environment corresponding to the real environment of the target system based on the acquired system management information; an event generation processing unit that selectively sets, for the generated mirror environment, a first operating state that simulates a normal operating state in the real environment of the target system and a second operating state that corresponds to an abnormal operating state in the real environment of the target system; a data management processing unit that collects operation data generated from the mirror environment in the first operating state and the second operating state, and outputs the collected operation data to the learning model as learning data; a recovery processing unit that controls recovery and resetting of the second operating state; Equipped with The data management processing unit acquires information indicating an amount of data required for learning from the learning model, and each time the second operating state is restored, determines whether or not the operating data generated in the mirror environment in the second operating state before restoration has reached the amount of data required for learning, and if not, instructs the restoration processing unit to reset the second operating state. Training data generation device.

2. The data management processing unit acquires information representing a type of data required for learning from the learning model, and selects one of a plurality of modes for setting an operating state based on the acquired information representing the type of data; The learning data generating device according to claim 1 , wherein the event occurrence processing unit selectively sets the first operating state and the second operating state for the mirror environment in accordance with the selected mode.

3. The learning data generation device of claim 2, wherein the data management processing unit selects, based on information representing the type of data, one of a first mode in which only the first operating state is generated, a second mode in which only the second operating state is generated, and a third mode in which the first operating state and the second operating state are generated sequentially.

4. A learning data generation method executed by a device that provides learning data to a learning model of a system that operates an operating state of a target system operating in a real environment using the learning model, comprising: acquiring system management information that defines functions of the target system, and generating a mirror environment corresponding to the real environment of the target system based on the acquired system management information; a step of selectively setting, for the generated mirror environment, a first operating state simulating a normal operating state in the real environment of the target system and a second operating state corresponding to an abnormal operating state in the real environment of the target system; a data management process for collecting operation data generated from the mirror environment in the first operating state and the second operating state, and outputting the collected operation data to the learning model as learning data; a recovery process for controlling recovery and resetting of the second operating state; Equipped with The data management process acquires information indicating an amount of data required for learning from the learning model, and each time the second operating state is restored, determines whether or not the operating data generated in the mirror environment in the second operating state before restoration has reached the amount of data required for learning, and if not, instructs the restoration process to reset the second operating state. Training data generation method.

5. A program that causes a processor provided in the training data generation device to execute processing by each of the processing units provided in the training data generation device described in any one of claims 1 to 3.

Images